A data transfer system enabling access to multiple subnets and method thereof is disclosed. The data transfer method includes the following steps: executing a virtual private network (vpn) client installed on an electronic system; connecting the vpn client to a vpn router; the vpn client assigning a virtual IP address to a virtual interface; and the vpn client accessing a subnet corresponding to the virtual IP address through the virtual IP address.
|
14. A data transfer method enabling access to multiple subnets and applying to an electronic system, comprising the following steps of:
executing a virtual private network (vpn) client installed on the electronic system;
connecting the vpn client to a vpn router;
assigning a virtual internet protocol (IP) address to a virtual interface by the vpn client; and
accessing, through the virtual IP address, at least one subnet corresponding to the virtual IP address by the vpn client.
1. A data transfer system enabling access to multiple subnets, comprising:
an electronic system comprising:
a memory unit comprising a virtual private network (vpn) client for simulating a virtual interface and assigning a virtual internet protocol (IP) address to the virtual interface;
a network unit providing a network transmission module; and
a processing unit connected to the memory unit and the network unit;
a vpn router connected to the network unit of the electronic system and providing the electronic system with the ability of logging in a vpn via the vpn router; and
a plurality of remote electronic systems connected to the vpn router and distributed in at least one subnet of the vpn;
wherein the electronic system is connected to the vpn router via the network unit, obtains the virtual IP address of the at least one subnet via the vpn router, and assigns the virtual IP address to the virtual interface, and the electronic system is connected to the plurality of remote electronic systems in the at least one subnet of the vpn.
2. The data transfer system enabling access to multiple subnets as claimed in
3. The data transfer system enabling access to multiple subnets as claimed in
4. The data transfer system enabling access to multiple subnets as claimed in
5. The data transfer system enabling access to multiple subnets as claimed in
6. The data transfer system enabling access to multiple subnets as claimed in
7. The data transfer system enabling access to multiple subnets as claimed in
8. The data transfer system enabling access to multiple subnets as claimed in
9. The data transfer system enabling access to multiple subnets as claimed in
10. The data transfer system enabling access to multiple subnets as claimed in
11. The data transfer system enabling access to multiple subnets as claimed in
12. The data transfer system enabling access to multiple subnets as claimed in
13. The data transfer system enabling access to multiple subnets as claimed in
15. The data transfer method enabling access to multiple subnets as claimed in
16. The data transfer method enabling access to multiple subnets as claimed in
17. The data transfer method enabling access to multiple subnets as claimed in
18. The data transfer method enabling access to multiple subnets as claimed in
19. The data transfer method enabling access to multiple subnets as claimed in
20. The data transfer method enabling access to multiple subnets as claimed in
|
The present invention relates to a data transfer system enabling access to multiple subnets and method thereof, and more particularly, to a data transfer system allowing a user to switch among and access multiple subnets and method thereof.
Nowadays, virtual private network (VPN) is an important technique for providing safe and dedicated communication connection over the public Internet. However, for general users, it is not easy to set up a VPN. For users who have to use VPNs, how to provide safe and convenient connection and access to VPN is an important issue. Complicated procedures involved in the setup of application programs and various limitations in accessing network resources would cause great inconveniences to users. For the purpose of simplifying the setup of a VPN, some commercially available products suggest that using Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) as a communication channel to establish a VPN, so that a user can determine which subnets in the VPN is accessible without understanding all the complicated procedures of setting up the VPN. Regarding to the established VPN connection of an Internet Protocol Security (IPSec) VPN, using HTTPS as the communication channel and using Microsoft Windows IPSec utility to establish a connection of an IPSec VPN are already known techniques. However, due to the highly complicated procedures of completing IPSec-related settings through the Local Security Policy, the currently available technique can only provide access to one-single subnet.
With the currently available network techniques, there is rapid growth in the network environment, and most of the enterprise networks usually have different network routings for different departments. Providing access to a single subnet can no longer satisfy the requirement. Currently, most of the small and medium business routers provide multiple subnets, and even many So-Ho routers are equipped with this function as well. Speaking of the information security, using virtual local area network (VLAN) techniques to distinguish various kinds of networks into user network and resource network is also a widely adopted way in network management. Therefore, when a VPN can only provide the access to single subnet, it would cause great inconveniences to users. Also, complication and security issues might be raised in network management if all important resources are in a certain subnet because of the limitations of VPN accessibility.
The conventional IPSec VPN application software adopting Microsoft Windows IPSec utility has another disadvantage with regard to network addressing. That is, the IPSec tunnel established by the conventional IPSec VPN application software adopting Microsoft Windows IPSec utility is using a host-to-gateway mode. Thus, the source IP address of the packet is the address of the computer running the application software, and this type of IP address might be a public IP address. When a user adopts the above application software to establish the IPSec tunnel and to connect to an intranet network, the packet with such public IP address might be detoured by a local default routing in the intranet network to result network latency. Further, packet missing might occur to cause problems in network management when the enterprise firewall does not allow such type of packets in the local area network.
In view of the drawbacks, an object of the present invention is to solve the problem causing by signal subnet accessibility in the IPSec utility under the premise of establishing an IPSec VPN by Microsoft Windows IPSec utility. The present invention further provides the function of accessing from different subnets by adopting the virtual IP address, so that a network manager can control the VPN packet address in a convenient manner.
Therefore, according to one aspect of the present invention, there is provided a data transfer system enabling access to multiple subnets. The data transfer system includes an electronic system, a VPN router, and a plurality of remote electronic systems. The electronic system includes a memory unit, a network unit, and a processing unit. The memory unit includes a VPN client for simulating a virtual interface and assigning a virtual IP address to the virtual interface. The network unit provides a network transmission module. The processing unit is connected to the memory unit and the network unit. The VPN router is connected to the electronic system via the network unit, so that the electronic system can log onto a VPN. The remote electronic systems are connected to the VPN router and are distributed in at least one subnet of the VPN. After obtaining the virtual IP address by the VPN router, the electronic system is connected to the remote electronic systems in the subnet.
In the data transfer system of the present invention, the network unit may be a network interface card or a network interface chip.
In the data transfer system of the present invention, the electronic system can be connected to the VPN router by a tunneling mode, which can be a split tunnel or a full tunnel, when the electronic system is connected to the VPN router. When the electronic system is connected to the VPN router through the split tunnel, only partial connections of the VPN client are directed to the VPN router. On the other hand, when the electronic system is connected to the VPN router through the full tunnel, all the connections of the VPN client are directed to the VPN router.
In the data transfer system of the present invention, the VPN client is connected to the VPN router in compliance with a network protocol, which can be HTTPS or HTTP.
In the data transfer system of the present invention, a connection between the VPN client and the VPN router may be established in compliance with the an Internet Protocol Security (IPSec) protocol, and the IPSec protocol may comprise a packet encryption process.
In the data transfer system of the present invention, the virtual interface has a virtual network interface card function simulated by the VPN client, and the virtual IP address can be assigned to the virtual interface.
In the data transfer system of the present invention, the virtual IP address corresponding to a subnet is within an IP address range of the subnet.
In the data transfer system of the present invention, when the virtual IP address is duplicated, the VPN client is arranged to re-establish the connection to the VPN router.
In the data transfer system of the present invention, the VPN router selectively sets a network address translation (NAT) rule according to the tunneling mode, and a non-physical IP address corresponds to physical IP address mapping in compliance with the NAT rule.
According to another aspect of the present invention, a data transfer method enabling access to multiple subnets is provided. The data transfer method includes the following steps: executing a VPN client installed on an electronic system; connecting the VPN client to a VPN router; assigning a virtual IP address to a virtual interface by the VPN client; and accessing at least one subnet corresponding to the virtual IP address through the virtual IP address and by the VPN client.
In the data transfer method of the present invention, the VPN has subnets. Each of the subnets has a different IP address range from each other, and the VPN router selects the virtual IP address from an unused virtual IP address in a virtual IP address range. Also, the virtual IP address range corresponds to an IP address range of the subnet.
Accordingly, the data transfer system enabling access to multiple subnets and method thereof according to the present invention has one or more of the following advantages:
(1) In the data transfer system and method, the accessibility of the multiple subnets in a VPN is improved by changing the virtual IP address and accessing different subnets.
(2) In the data transfer system and method, the VPN client can be connected to the VPN router via a tunneling mode acceptable to the VPN router, so that the flexibility in connection of the electronic system to the VPN can be increased.
The structure and the technical means adopted by the present invention to achieve the above and other objects can be best understood by referring to the following detailed description of the preferred embodiments and the accompanying drawings, wherein
The present invention will now be described with some preferred embodiments thereof. For the purpose of easy to understand, elements that are the same in the preferred embodiments are denoted by the same reference numerals.
Please refer to
The electronic device 1 is first connected to the VPN router 2 by the network unit 11. A user can use the VPN client 100 to connect to the VPN router 2 via a split tunnel or a full tunnel. Then, a virtual IP address can be obtained by the VPN router 2, and the virtual IP address can be assigned to the virtual interface. Thereafter, the electronic device 1 can be connected to the remote electronic systems 30 in the VPN 3. Also, the network unit may be a network interface card or a network interface chip, and a connection between the VPN client and the VPN router may be established in accordance with the Internet Protocol Security (IPSec) protocol. The IPSec protocol may comprise a packet encryption process. Further, the virtual interface has a virtual network interface card function simulated by the VPN client, and the virtual IP address is assigned to the virtual interface.
Please refer to
To solve this problem, the present invention utilizes the VPN client 100 to obtain a virtual IP address via the VPN router 2. The virtual IP address is an IP address within the IP address range of the VLANs 310, 311, 322 and 323. The VLANs 310, 311, 322 and 323 are respectively a subnet of the VPN 3. When it is desired to access the VLAN 310, first a virtual IP address is assigned to the VPN client 100 by the VPN router 2, and the virtual IP address is ranged from 192.168.1.0 to 192.168.1.24. Then, the electronic system 1 is connected to the VLAN 310. In the event the assigned virtual IP address is the same as an IP address of the remote electronic systems 30, another virtual IP address is assigned again. Therefore, the electronic system 1 can become a member of the VLAN 310, and the local security policy in compliance with the Internet Protocol Security (IPSec) protocol is applicable to the electronic system 1, allowing the electronic system 1 to connect to and use related resources of the VLAN 310. Also, when the user desires to connect to the VLAN 311, the VPN router 2 can assign an IP address ranged between 192.168.2.0 and 192.168.2.24 to the VPN client 100 as a virtual IP address.
Please refer to
Regarding the connection of the electronic system 1 to the VPN router 2, the conventional VPN client can only connect to the VPN router 2 through the split tunnel or the full tunnel. When the VPN router 2 can accept only one of the split tunnel and the full tunnel, failed connection is usually occurred. In the present invention, the flexibility is increased by connecting the VPN client to the VPN router 2 through the split tunnel or the full tunnel.
Please refer to
With the aforementioned arrangements, it is able to reduce the load of the VPN router 2 and no additional bandwidth is needed.
Please refer to
As shown, in step S11, a VPN client installed in an electronic system is executed by a user.
Then, in step S12, the VPN client is connected to a VPN router via a user-selected tunneling mode and using the Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) or the Hypertext Transfer Protocol (HTTP).
Then, in step S13, the VPN client uses an Internet Protocol Security (IPSec) protocol to connect to the VPN router, and a virtual IP address is assigned to a virtual interface simulated by the VPN client.
Then, in step S14, the VPN client accesses a subnet, corresponding to the virtual IP address, in a VPN through the virtual IP address. In the event the virtual IP address is the same as another IP address in the subnet, step S13 is operated to obtain a new IP address. Otherwise, if the virtual IP address is not the same as any other IP address in the subnet, go to step S15.
Finally, in step S15, the VPN client operates on the subnet corresponding to the virtual IP address.
The present invention has been described with some preferred embodiments thereof and it is understood that many changes and modifications in the described embodiments can be carried out without departing from the scope and the spirit of the invention that is intended to be limited only by the appended claims.
Chen, Chia-Meng, Tan, Der-Hwa, Lai, Chung-Chiu
Patent | Priority | Assignee | Title |
10057295, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
10084799, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
10089462, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
10116624, | Feb 13 2009 | Extreme Networks, Inc | Intelligent sorting for N-way secure split tunnel |
10218742, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
10230766, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
10284603, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
10291656, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
10313368, | Dec 13 2005 | CUPP Computing AS | System and method for providing data and device security between external and host devices |
10397227, | Oct 09 2012 | CUPP Computing AS | Transaction security systems and methods |
10404660, | Mar 26 2008 | CUPP Computing AS | System and method for implementing content and network security inside a chip |
10404722, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
10417400, | Nov 19 2008 | CUPP Computing AS | Systems and methods for providing real time security and access monitoring of a removable media device |
10417421, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
10419459, | Mar 05 2007 | CUPP Computing AS | System and method for providing data and device security between external and host devices |
10505896, | Mar 26 2008 | CUPP Computing AS | System and method for implementing content and network security inside a chip |
10541969, | Mar 26 2008 | CUPP Computing AS | System and method for implementing content and network security inside a chip |
10567403, | Mar 05 2007 | CUPP Computing AS | System and method for providing data and device security between external and host devices |
10621344, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
10666688, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
10701034, | Feb 13 2009 | Extreme Networks, Inc | Intelligent sorting for N-way secure split tunnel |
10742663, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
10826874, | Nov 29 2018 | MasterCard International Incorporated | Direct production network access using private networks and encapsulation |
10839075, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
10904254, | Oct 09 2012 | CUPP Computing AS | Transaction security systems and methods |
10904293, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
10951632, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
10951659, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
10999302, | Mar 05 2007 | CUPP Computing AS | System and method for providing data and device security between external and host devices |
11036836, | Nov 19 2008 | CUPP Computing AS | Systems and methods for providing real time security and access monitoring of a removable media device |
11050712, | Mar 26 2008 | CUPP Computing AS | System and method for implementing content and network security inside a chip |
11157976, | Jul 08 2013 | CUPP Computing AS | Systems and methods for providing digital content marketplace security |
11316905, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
11449613, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
11461466, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
11604861, | Nov 19 2008 | CUPP Computing AS | Systems and methods for providing real time security and access monitoring of a removable media device |
11652829, | Mar 05 2007 | CUPP Computing AS | System and method for providing data and device security between external and host devices |
11743297, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
11757835, | Mar 26 2008 | CUPP Computing AS | System and method for implementing content and network security inside a chip |
11757885, | Oct 09 2012 | CUPP Computing AS | Transaction security systems and methods |
11757941, | May 30 2007 | CUPP Computer AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
11775644, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
11822653, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
11947674, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
8423631, | Feb 13 2009 | Extreme Networks, Inc | Intelligent sorting for N-way secure split tunnel |
9106683, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
9143466, | Feb 13 2009 | Extreme Networks, Inc | Intelligent sorting for N-way secure split tunnel |
9391956, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
9516040, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
9712564, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
9747444, | Dec 13 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
9756079, | May 30 2007 | CUPP Computing AS | System and method for providing network and computer firewall protection with dynamic address isolation to a device |
9762541, | Feb 13 2009 | Extreme Networks, Inc | Intelligent sorting for N-way secure split tunnel |
9762614, | Feb 13 2014 | CUPP Computing AS | Systems and methods for providing network security using a secure digital device |
9781164, | Dec 23 2005 | CUPP Computing AS | System and method for providing network security to mobile devices |
9843595, | Aug 04 2008 | CUPP Computing AS | Systems and methods for providing security services during power management mode |
9935957, | Oct 09 2012 | CUPP Computing AS | Transaction security systems and methods |
9973501, | Oct 09 2012 | CUPP Computing AS | Transaction security systems and methods |
ER4517, |
Patent | Priority | Assignee | Title |
7509491, | Jun 14 2004 | Cisco Technology, Inc. | System and method for dynamic secured group communication |
7542476, | Aug 29 2003 | Flash Networks LTD | Method and system for manipulating IP packets in virtual private networks |
7840701, | Feb 21 2007 | ARRAY NETWORKS, INC | Dynamic system and method for virtual private network (VPN) packet level routing using dual-NAT method |
20040264402, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Jun 28 2010 | TAN, DER-HWA | GEMTEK TECHNOLOGY CO , LTD | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 024635 | /0250 | |
Jun 28 2010 | CHEN, CHIA-MENG | GEMTEK TECHNOLOGY CO , LTD | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 024635 | /0250 | |
Jun 28 2010 | LAI, CHUNG-CHIU | GEMTEK TECHNOLOGY CO , LTD | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 024635 | /0250 | |
Jul 05 2010 | Gemtek Technology Co. Ltd. | (assignment on the face of the patent) | / |
Date | Maintenance Fee Events |
Oct 22 2015 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Oct 28 2019 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Nov 22 2023 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
Date | Maintenance Schedule |
Jul 10 2015 | 4 years fee payment window open |
Jan 10 2016 | 6 months grace period start (w surcharge) |
Jul 10 2016 | patent expiry (for year 4) |
Jul 10 2018 | 2 years to revive unintentionally abandoned end. (for year 4) |
Jul 10 2019 | 8 years fee payment window open |
Jan 10 2020 | 6 months grace period start (w surcharge) |
Jul 10 2020 | patent expiry (for year 8) |
Jul 10 2022 | 2 years to revive unintentionally abandoned end. (for year 8) |
Jul 10 2023 | 12 years fee payment window open |
Jan 10 2024 | 6 months grace period start (w surcharge) |
Jul 10 2024 | patent expiry (for year 12) |
Jul 10 2026 | 2 years to revive unintentionally abandoned end. (for year 12) |